NFS

NFS exports Unix filesystems over the network, and with the traditional AUTH_SYS security it trusts the client-supplied user and group IDs entirely. The offensive surface is enumerating exports and their options, abusing no_root_squash to write files as root, spoofing UIDs and GIDs to read and write any user's files, and the weaker points of NFSv4 with Kerberos.

1 മിനിറ്റ് വായന2026 ഒക്ടോ 5-ന് അപ്ഡേറ്റ് ചെയ്തുflorianamette1 സംഭാവകൻ
നിങ്ങളുടെ അസിസ്റ്റന്റിനോട് ചോദിക്കുക (MCP)GitHub-ൽ എഡിറ്റ് ചെയ്യുക

NFS (Network File System) exports Unix directories over the network. Its defining weakness is the traditional AUTH_SYS (sec=sys) security model, under which the server trusts whatever user and group IDs the client includes in each request: there is no authentication of the client's claimed identity, only the IDs it asserts. That makes an NFS export with default options a near-open door. The surface is enumerating the exports and their options, abusing no_root_squash to act as root on the export, spoofing arbitrary UIDs/GIDs to access any user's files, and the comparatively harder NFSv4-with-Kerberos configurations.

bash
# discover exports and the RPC services behind NFS
showmount -e <target>                         # exported paths and allowed clients
rpcinfo -p <target>                           # mountd/nfs/portmapper ports
nmap -p111,2049 --script nfs-showmount,nfs-ls <target>

Subtopics#

References#

മുമ്പത്തേത്Guest accessഅടുത്തത് Enumeration